Security and compliance-first architecture

Every table carries row-level rules. A patient row can be read by that patient. A clinic row can be read by that clinic's owner and active staff. There is no query path — from the app, from a script, or from a developer console — that returns someone else's record.

• Patient, clinic owner, clinic staff, moderator, support, compliance and administrator are distinct roles held in their own table, never on a profile that a user can edit.
• Clinic data is separated by tenant: one clinic cannot see another clinic's bookings, patients, notes or money.
• Administrators see access records, states and system events — not your clinical content.

• Stored in private storage, never on a public address.
• Screened for malicious content before they can be opened.
• Opened through short-lived links issued only after an ownership check on the server.
• Every successful opening written to your access history, with who opened it and when.
• Shares carry an expiry and can be withdrawn, which takes effect immediately.

• One account per person, with a one-time code option at sign-in.
• Device lock after a quiet period.
• Sign out here, or on every device at once.

Chat and voice answers pass through a policy engine before and after the model runs. Personal identifiers are redacted before processing, answers are grounded in clinical text that a named reviewer approved, emergency wording is escalated, and any action that changes your records needs a human decision. Every exchange leaves a trace with the sources and policy decisions attached.

Clinical wording is versioned and immutable once published. Release gates record whether each milestone passed, failed or is blocked, and the security sign-off register shows which evidence exists and which is still owed.